Issue 6985:
Lot's of %SetProperty calls for dictionaries

Issue description

In the profile for the chai benchmark we see lots of calls to the %SetProperty runtime function. Almost all of these come from the generic KeyedStoreIC. It seems that the logic to decide whether the prototype chain is fine has a bug where it would go to the "bailout" label if the prototype is null, which was supposed to be the fast-path. That means that for example the transferFlags module always hits the slow-path:
================================================================================================
module.exports = function transferFlags(assertion, object, includeAll) {
var flags = assertion.__flags || (assertion.__flags = Object.create(null));
if (!object.__flags) {
object.__flags = Object.create(null);
}
includeAll = arguments.length === 3 ? includeAll : true;
for (var flag in flags) {
if (includeAll ||
(flag !== 'object' && flag !== 'ssfi' && flag !== 'lockSsfi' && flag != 'message')) {
object.__flags[flag] = flags[flag];
}
}
};
================================================================================================
In addition to that, we also seem to call %SetProperty when we need to rehash/grow, although there's already a proper runtime function %AddDictionaryProperty for this. It looks like picking these two low hanging fruits should make it possible to considerably reduce the 6-8% overhead of %SetProperty in the chai test.